DLP Endpoint Incident cubes processing failure: The size specified for a binding was too small

Products

• IT Analytics

Issue/Introduction

IT Analytics (ITA) processing jobs for the DLP Endpoint Incident Details and DLP Endpoint Incident Summary cubes fail and the SQL Server Agent logs the following error:

<Warning WarningCode="2165374978" Description="Errors in the back-end database access module. The size specified for a binding was too small, resulting in one or more column values being truncated." Source="Microsoft SQL Server 2016 Analysis Services" HelpFile="" />

After following the procedure documented in KB article 224711, the failure is traced to the column Endpoint Incident - Machine Name.

Environment

Release : 2.9.1

Component : Cubes

Cause

An endpoint agent's machine (computer) name exceeds 15 characters.

The NETBIOS naming standard restricts Windows machine names to 15 characters, with a 16th character "reserved to identify the functionality that is installed on the registered network device". See the following Microsoft document for more information:

Naming conventions in Active Directory for computers, domains, sites, and OUs

Computer endpoints that do not conform to the NETBIOS standard, such as those running macOS or Linux, may have machine names that exceed this length limitation.

Resolution

To increase the column binding size for the Endpoint Incident - Machine Name attribute, follow this procedure:

1. Open SQL Server Management Studio (SSMS)
2. Connect to the Analysis Services server hosting the ITA cubes
3. In Object Explorer, navigate to Databases > ITAnalytics > Dimensions
4. Right-click the dimension DLP Endpoint Incident and select Script Dimension as > ALTER To > New Query Editor Window
5. In the XMLA query window, go to line 1015 and locate the following section for the Endpoint Incident - Machine Name attribute:

   <ID>Endpoint Incident - Machine Name</ID>
   <Name>Endpoint Incident - Machine Name</Name>
   <KeyColumns>
       <KeyColumn>
           <DataType>WChar</DataType>
           <DataSize>15</DataSize>
           <InvalidXmlCharacters>Remove</InvalidXmlCharacters>
           <Source xsi:type="ColumnBinding">
               <TableID>EndpointIncidentDim</TableID>
               <ColumnID>EndpointMachineName</ColumnID>
           </Source>
       </KeyColumn>
   </KeyColumns>
   <NameColumn>
       <DataType>WChar</DataType>
       <DataSize>15</DataSize>
       <InvalidXmlCharacters>Remove</InvalidXmlCharacters>
       <Source xsi:type="ColumnBinding">
           <TableID>EndpointIncidentDim</TableID>
           <ColumnID>EndpointMachineName</ColumnID>
       </Source>
   </NameColumn>

6. Change the DataSize values for the KeyColumn and NameColumn bindings on lines 1020 and 1030 from 15 to 255
7. Execute the script by pressing the F5 key, clicking the Execute button in the SQL Editor toolbar, or selecting Execute from the Query menu
8. Re-run the cube processing job

Additional Information

The DLP Endpoint Incident dimension is populated during cube processing by the view vITAnalytics_DLP_EndpointIncidentDim, which specifies a datatype of nvarchar for the ENDPOINTMACHINENAME column and a string length of 255; however, the column bindings for the dimension's Endpoint Incident - Machine Name attribute are restricted to 15 characters, per the NETBIOS standard.